ShelfjetLegal
Data Processing Agreement
Last updated 28 September 2026 · Effective from that date · Forms part of the Terms of Service
This Data Processing Agreement ("DPA") applies whenever Cool Brands Pte Ltd (UEN 202324371E), 4008 Ang Mo Kio Avenue 10, #02-16, Techplace 1, Singapore 569625, Singapore ("Shelfjet", the "Processor") processes personal data on behalf of a customer (the "Merchant", the "Controller") in the course of providing the Shelfjet service. It is incorporated into the Terms of Service; no signature is needed. Merchants who need a countersigned copy can request one at privacy@shelfjet.com.
1. Scope and roles
The Merchant determines the purposes and means of processing its customers' personal data ("Buyer Data"). Shelfjet processes Buyer Data only to provide the service described in the Terms: importing orders, managing stock, arranging shipments, printing labels, reporting, and the automations the Merchant configures. Shelfjet does not sell Buyer Data, use it for its own marketing or analytics, or combine it across merchants. Shelfjet is a data intermediary under the Singapore PDPA and a processor under the GDPR/UK GDPR where those apply.
2. Details of processing
| Subject matter | Fulfilment of the Merchant's marketplace and web-store orders. |
|---|---|
| Duration | The life of the Merchant's account plus the retention periods in the Privacy Policy. |
| Data subjects | The Merchant's customers (buyers) and the Merchant's staff. |
| Categories of data | Name, delivery address, phone number, e-mail address, order contents and value, payment status, courier tracking events, buyer notes. No special-category data is intended to be processed. |
| Location | Singapore (Render, PostgreSQL). Sub-processors listed in section 6. |
3. Merchant instructions
Shelfjet processes Buyer Data only on the Merchant's documented instructions, which are: the Terms, this DPA, the settings and automation rules the Merchant configures in the app, and the channel and courier connections the Merchant authorises. Shelfjet will inform the Merchant if an instruction appears to breach applicable data-protection law.
4. Shelfjet's obligations
- Confidentiality. Only staff who need access to operate and support the service have it, under confidentiality obligations. Support access to a workspace is logged.
- Security. Measures described in section 6 of the Privacy Policy: encryption in transit (TLS/HSTS) and at rest for credentials, hashed passwords, mandatory two-factor authentication for owners and administrators, a database reachable only from the application, tenant-isolation tests on every release, audit logging with IP and user agent, continuous backups with point-in-time recovery, and dependency vulnerability gating in CI.
- Assistance. Shelfjet helps the Merchant respond to data-subject requests: buyer data can be redacted per order or per customer from the app, Shopify's data-request and redaction webhooks (customers/data_request, customers/redact, shop/redact) are honoured automatically, and deletion requests from TikTok Shop, Lazada or Shopee are actioned within 30 days of receipt. Access and correction requests received directly from a buyer are passed to the Merchant.
- Breach notification. Shelfjet notifies the Merchant without undue delay, and in any case within 72 hours, after becoming aware of a personal-data breach affecting Buyer Data, with the information the Merchant needs for its own notifications.
- Deletion and return. On termination the Merchant can export all data for 30 days; Shelfjet then deletes Buyer Data within a further 30 days, except for what the law requires be kept, and confirms deletion in writing on request. Backups are overwritten within 7 days of deletion.
- Audit. Once a year, on 30 days' notice, the Merchant may request a written description of Shelfjet's security measures and the results of the most recent penetration test; on-site audits are available where legally required, at the Merchant's cost.
5. Merchant's obligations
The Merchant warrants it has the legal basis and any consents needed to collect Buyer Data through its channels and to have Shelfjet process it, that its instructions are lawful, and that it will keep its own accounts, staff access and API keys secure.
6. Sub-processors
The Merchant authorises the following sub-processors. Shelfjet will give 30 days' notice before adding one; the Merchant may object on reasonable grounds and, if unresolved, terminate the affected service.
| Sub-processor | Purpose | Location |
|---|---|---|
| Render Services, Inc. | Application hosting, managed PostgreSQL, backups | Singapore |
| Stripe Payments Singapore Pte Ltd | Subscription payment processing for the Merchant's own account (billing contact and card details; no Buyer Data). Card data never touches Shelfjet. | Singapore (Stripe group entities worldwide) |
| Slack Technologies | Chat integration (only when enabled by the Merchant) | United States |
| Marketplaces, web-store platforms and couriers the Merchant connects | Order, stock and shipment exchange at the Merchant's instruction | Per platform |
7. International transfers
Buyer Data is stored in Singapore. Transfers to platforms and couriers outside Singapore happen only because the Merchant instructs them by connecting that channel; the Merchant is responsible for the lawful basis of those transfers. Where the GDPR applies, the EU Standard Contractual Clauses (Module 2, controller-to-processor) are incorporated by reference for transfers from the EEA to Shelfjet.
8. Liability
Liability under this DPA is subject to the limits in the Terms of Service.
9. Term, governing law and changes
This DPA lasts as long as Shelfjet processes Buyer Data for the Merchant. It is governed by the laws of Singapore and disputes are resolved as set out in section 11 of the Terms of Service (Singapore courts, or SIAC arbitration where agreed). Changes to this DPA are announced with the same notice as changes to the Terms; the sub-processor list may also be updated as described in section 6.
Contact
Data Protection Officer (Edison Lim), Cool Brands Pte Ltd (UEN 202324371E), 4008 Ang Mo Kio Avenue 10, #02-16, Techplace 1, Singapore 569625, Singapore · privacy@shelfjet.com · General support: support@shelfjet.com